urlscan.io logo urlscan.io
SecurityTrails logo

www.chinastemi.com Open in urlscan Pro
218.240.38.11  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://1t.click/aG5J
Effective URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Submission: On October 22 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 7 domains to perform 16 HTTP transactions. The main IP is 218.240.38.11, located in China and belongs to CNIX-AP China Networks Inter-Exchange, CN. The main domain is www.chinastemi.com.
This is the only time www.chinastemi.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 104.244.77.76 53667 (PONYNET)
1 218.240.38.11 4847 (CNIX-AP C...)
1 219.143.121.28 4847 (CNIX-AP C...)
2 180.166.137.67 4812 (CHINANET-...)
9 60.191.123.28 4134 (CHINANET-...)
2 45.249.213.198 63655 (HWDGNET H...)
1 2 203.81.22.45 9298 (GHXTNET B...)
16 6
1    104.244.77.76 (Roost, Luxembourg)

ASN53667 (PONYNET - FranTech Solutions, US)
1t.click
1    218.240.38.11 (China)

ASN4847 (CNIX-AP China Networks Inter-Exchange, CN)
www.chinastemi.com
1    219.143.121.28 (Beijing, China)

ASN4847 (CNIX-AP China Networks Inter-Exchange, CN)
imail.isoftstone.com
2    180.166.137.67 (Shanghai, China)

ASN4812 (CHINANET-SH-AP China Telecom (Group), CN)
PTR: smg2.comac.cc
mail.comac.cc
9    60.191.123.28 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)
cas.h3c.com
2    45.249.213.198 (Shenzhen, China)

ASN63655 (HWDGNET Huawei Technologies Co., Ltd, CN)
exmailcn.huawei.com
2    203.81.22.45 (Beijing, China)

ASN9298 (GHXTNET Beijing GuanghuanXuntong Digital Technology Co.,LTD., CN)
PTR: mx1.ckgsb.edu.cn
mail2.ckgsb.com
Domain Requested by
9 cas.h3c.com www.chinastemi.com
2 mail2.ckgsb.com 1 redirects www.chinastemi.com
2 exmailcn.huawei.com www.chinastemi.com
2 mail.comac.cc www.chinastemi.com
1 imail.isoftstone.com www.chinastemi.com
1 www.chinastemi.com
1 1t.click 1 redirects
16 7

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
Subject Issuer Validity Valid
*.isoftstone.com
Go Daddy Secure Certificate Authority - G2		 2017-10-24 -
2020-10-10		 3 years crt.sh
mail.comac.cc
GeoTrust CN RSA CA G1		 2019-10-22 -
2021-12-09		 2 years crt.sh
*.h3c.com
DigiCert SHA2 Secure Server CA		 2018-10-26 -
2021-01-06		 2 years crt.sh
exmailcn.huawei.com
Actalis Organization Validated Server CA G2		 2019-06-11 -
2021-06-11		 2 years crt.sh
*.ckgsb.com
GlobalSign Organization Validation CA - SHA256 - G2		 2019-05-07 -
2021-08-08		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Frame ID: 7F73AA75181417D8752BB76EB467AD64
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://1t.click/aG5J HTTP 301
    http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /CentOS/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

16
Requests

94 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

6
IPs

2
Countries

73 kB
Transfer

135 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://1t.click/aG5J HTTP 301
    http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8
  • https://mail2.ckgsb.com/owa/14.3.123.3/themes/resources/lgnexlogo.gif HTTP 302
  • https://mail2.ckgsb.com/owa/auth/logon.aspx?url=https%3a%2f%2fmail2.ckgsb.com%2fowa%2f14.3.123.3%2fthemes%2fresources%2flgnexlogo.gif&reason=0

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ballard.amazon.com.html
www.chinastemi.com/data/backupdata/Microsoft/
Redirect Chain
  • http://1t.click/aG5J
  • http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
11 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Server
218.240.38.11 , China, ASN4847 (CNIX-AP China Networks Inter-Exchange, CN),
Reverse DNS
Software
Apache/2.2.15 (CentOS) /
Resource Hash
30f29422f44294326f7b1ba6ab59f985fa37bdfdd0d7c5f39dd1be4e12411879

Request headers

Host
www.chinastemi.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 21:52:06 GMT
Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 22 Oct 2019 06:34:30 GMT
ETag
"283bc6-2c04-59579fe1d9f12"
Accept-Ranges
bytes
Content-Length
11268
Keep-Alive
timeout=15, max=1000
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Tue, 22 Oct 2019 23:22:42 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
ASP.NET
Set-Cookie
PHPSESSID=cbd8fr4polq3t90afut9g3gdl7; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
DBS
SSDB
Location
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
X-Powered-By-Z
KS4C2
Server
Microsoft-IIS/8.2
Publish
LUX
jquery-1.9.1.min.js
imail.isoftstone.com/view/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://imail.isoftstone.com/view/js/jquery-1.9.1.min.js
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
219.143.121.28 Beijing, China, ASN4847 (CNIX-AP China Networks Inter-Exchange, CN),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
jquery-1.8.3.min.js
mail.comac.cc/owa/auth/js/ 		91 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mail.comac.cc/owa/auth/js/jquery-1.8.3.min.js
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.0, ECDHE_RSA, AES_256_CBC
Server
180.166.137.67 Shanghai, China, ASN4812 (CHINANET-SH-AP China Telecom (Group), CN),
Reverse DNS
smg2.comac.cc
Software
/ ASP.NET
Resource Hash
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:20:45 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 03:56:06 GMT
X-Powered-By
ASP.NET
ETag
"08f5047d51d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public,max-age=2592000
Accept-Ranges
bytes
Content-Length
32452
jquery.cookie.js
mail.comac.cc/owa/auth/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mail.comac.cc/owa/auth/js/jquery.cookie.js
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.0, ECDHE_RSA, AES_256_CBC
Server
180.166.137.67 Shanghai, China, ASN4812 (CHINANET-SH-AP China Telecom (Group), CN),
Reverse DNS
smg2.comac.cc
Software
/ ASP.NET
Resource Hash
13161f845883ddc67c4adec84919b2350c3ab125c5c4263dbb736594c54ccd71

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:20:45 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 03:56:06 GMT
X-Powered-By
ASP.NET
ETag
"08f5047d51d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public,max-age=2592000
Accept-Ranges
bytes
Content-Length
1332
logon.css
cas.h3c.com/owa/14.3.415.0/themes/resources/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cas.h3c.com/owa/14.3.415.0/themes/resources/logon.css
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:44 GMT
Content-Encoding
gzip
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
945
owafont_zh_chs.css
cas.h3c.com/owa/14.3.248.2/themes/resources/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cas.h3c.com/owa/14.3.248.2/themes/resources/owafont_zh_chs.css
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
30f412c43f8a261b5727d613c1f17c80c1d8a031cca1c00f3443d864a7e6bef4

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:44 GMT
Content-Encoding
gzip
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1913
flogon.js
cas.h3c.com/owa/14.3.248.2/scripts/premium/ 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cas.h3c.com/owa/14.3.248.2/scripts/premium/flogon.js
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:44 GMT
ETag
"0a1e8ac4098d01:0"
Last-Modified
Wed, 27 May 2015 05:47:54 GMT
X-Powered-By
ASP.NET
Content-Type
application/x-javascript
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4296
CookieAuth.dll
exmailcn.huawei.com/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://exmailcn.huawei.com/CookieAuth.dll?GetPic?formdir=1&image=lgntopl.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.0, RSA, AES_128_CBC
Server
45.249.213.198 Shenzhen, China, ASN63655 (HWDGNET Huawei Technologies Co., Ltd, CN),
Reverse DNS
Software
/
Resource Hash
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-control
max-age=604800
Connection
close
Content-Length
4455
Content-Type
image/gif
CookieAuth.dll
exmailcn.huawei.com/ 		581 B
696 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://exmailcn.huawei.com/CookieAuth.dll?GetPic?formdir=1&image=lgntopr.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.0, RSA, AES_128_CBC
Server
45.249.213.198 Shenzhen, China, ASN63655 (HWDGNET Huawei Technologies Co., Ltd, CN),
Reverse DNS
Software
/
Resource Hash
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-control
max-age=604800
Connection
close
Content-Length
581
Content-Type
image/gif
logon.aspx
mail2.ckgsb.com/owa/auth/
Redirect Chain
  • https://mail2.ckgsb.com/owa/14.3.123.3/themes/resources/lgnexlogo.gif
  • https://mail2.ckgsb.com/owa/auth/logon.aspx?url=https%3a%2f%2fmail2.ckgsb.com%2fowa%2f14.3.123.3%2fthemes%2fresources%2flgnexlogo.gif&reason=0
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mail2.ckgsb.com/owa/auth/logon.aspx?url=https%3a%2f%2fmail2.ckgsb.com%2fowa%2f14.3.123.3%2fthemes%2fresources%2flgnexlogo.gif&reason=0
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.81.22.45 Beijing, China, ASN9298 (GHXTNET Beijing GuanghuanXuntong Digital Technology Co.,LTD., CN),
Reverse DNS
mx1.ckgsb.edu.cn
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date
Tue, 22 Oct 2019 23:21:10 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
status
302
content-type
text/html; charset=utf-8
location
https://mail2.ckgsb.com/owa/auth/logon.aspx?url=https%3a%2f%2fmail2.ckgsb.com%2fowa%2f14.3.123.3%2fthemes%2fresources%2flgnexlogo.gif&reason=0
request-id
7943ba28-c97c-4243-805c-5ae96a4d9b20
content-length
263
x-feserver
BJ-EXCH05
lgnbotl.gif
cas.h3c.com/owa/14.3.415.0/themes/resources/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cas.h3c.com/owa/14.3.415.0/themes/resources/lgnbotl.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:44 GMT
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
9311
lgnbotr.gif
cas.h3c.com/owa/14.3.415.0/themes/resources/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cas.h3c.com/owa/14.3.415.0/themes/resources/lgnbotr.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:45 GMT
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2392
lgntopm.gif
cas.h3c.com/owa/14.3.415.0/themes/resources/ 		58 B
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cas.h3c.com/owa/14.3.415.0/themes/resources/lgntopm.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cas.h3c.com/owa/14.3.415.0/themes/resources/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:45 GMT
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
58
lgnleft.gif
cas.h3c.com/owa/14.3.415.0/themes/resources/ 		290 B
571 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cas.h3c.com/owa/14.3.415.0/themes/resources/lgnleft.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cas.h3c.com/owa/14.3.415.0/themes/resources/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:45 GMT
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
290
lgnright.gif
cas.h3c.com/owa/14.3.415.0/themes/resources/ 		306 B
587 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cas.h3c.com/owa/14.3.415.0/themes/resources/lgnright.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cas.h3c.com/owa/14.3.415.0/themes/resources/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:45 GMT
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
306
lgnbotm.gif
cas.h3c.com/owa/14.3.415.0/themes/resources/ 		276 B
557 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cas.h3c.com/owa/14.3.415.0/themes/resources/lgnbotm.gif
Requested by
Host: www.chinastemi.com
URL: http://www.chinastemi.com/data/backupdata/Microsoft/ballard.amazon.com.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
60.191.123.28 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
/ ASP.NET
Resource Hash
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cas.h3c.com/owa/14.3.415.0/themes/resources/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 22 Oct 2019 23:22:45 GMT
ETag
"0638e93b13ce1:0"
Last-Modified
Tue, 05 Feb 2013 15:00:46 GMT
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
public,max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
276

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| initLogon function| redir function| shw function| hd function| clkExp function| clkSec function| clkBsc function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker function| secureCookie function| isHttps number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr

1 Cookies

Domain/Path Name / Value
www.chinastemi.com/data/backupdata/Microsoft Name: cookieTest
Value: 1